// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <stddef.h>
#include <stdint.h>

#include <algorithm>
#include <vector>

#include "net/http/http_chunked_decoder.h"

// Entry point for LibFuzzer.
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
    const char* data_ptr = reinterpret_cast<const char*>(data);
    net::HttpChunkedDecoder decoder;

    // Feed data to decoder.FilterBuf() by blocks of "random" size.
    size_t block_size = 0;
    for (size_t offset = 0; offset < size; offset += block_size) {
        // Since there is no input for block_size values, but it should be strictly
        // determined, let's calculate these values using a couple of data bytes.
        uint8_t temp_block_size = data[offset] ^ data[size - offset - 1];

        // Let temp_block_size be in range from 0 to 0x3F (0b00111111).
        temp_block_size &= 0x3F;

        // XOR with previous block size to get different values for different data.
        block_size ^= temp_block_size;

        // Prevent infinite loop if block_size == 0.
        block_size = std::max(block_size, static_cast<size_t>(1));

        // Prevent out-of-bounds access.
        block_size = std::min(block_size, size - offset);

        // Create new buffer with current block of data and feed it to the decoder.
        std::vector<char> buffer(data_ptr + offset, data_ptr + offset + block_size);
        int result = decoder.FilterBuf(buffer.data(), buffer.size());
        if (result < 0)
            return 0;
    }

    return 0;
}
